Let's talk about mitigation strategies.
So what can we do here.
Well we can enable S&P signing on all devices right.
And that is the go to strategy.
The pro here is that it completely stops the attack.
The con is that there can be performance issues with file copies.
It's reported that it's about a 15 percent or so decrease in speed on file transfers when you're running
with SMB.
So that SMB signing does cause a little bit longer time period.
But the thing I argue is that the longer time period for computer security is worth it it's worth the
tradeoff other options that you can take is you can disable entail them authentication on the network
if there is no end to them authentication then it completely stops the attack.
However if curb growth stops working as the authentication method then Windows is going to default back
to entail them anyway.
So it's not a failsafe completely.
More things account Dearing is super important.
So what that means is if you have a domain administrator that domain administrators only logging into
their domain accounts or their their domain servers their domain controllers right.
They're not logging into a user account because that would be really bad if we can capture a domain
administrator in this sort of attack.
The other thing too is that you want local AV and restriction here.
So if we don't have a local administrator this can prevent a lot of lateral movement.
We can't really get the shell we can't get the hashes that we saw none of that would happen if that
Frank capsule user was not also a local administrator on another machine.
So the con here is that you might see a potential increase in the amount of service desk tickets users
complain about it.
They always want to have admin but it's not usually in the best interests of the company to give your
users administrator rights on a computer.
So that's it for SMB really a big thing to talk about again is that SMB signing should be disabled and
that local admins should be really restricted here.
The other two are just best practice sort of things but still don't completely eliminate the attack.
So from here we're going to go ahead and talk about gaining shell access and how we can gain shells
with some of the information that we've already gathered right now.
And then we'll move into some IP 6 attacks which are really really fun and onto enumeration.
So I'll see you over in the next video.